search menu icon-carat-right cmu-wordmark

CERT Coordination Center


sysback makes call to hostname without a fully qualified path specification

Vulnerability Note VU#17566

Original Release Date: 2000-12-12 | Last Revised: 2000-12-12

Overview

sysback, shipped with AIX systems, allows local users to gain root access because of a failure to use a fully qualified path for a call to hostname.

Description

sysback includes a call to hostname but does not include a full path specification. Because sysback is set uid root, intruders can put a malicious hostname in the path before the "real" hostname, and thereby execute any commands with root privileges.

Impact

Local users can execute arbitrary commands and programs with root privileges.

Solution

Update to sysback.rte 4.2.1.13 as described in the IBM vendor statement.

Remove setuid root from sysback in environments that permit it (where such a change would not be detrimental to operations).

Vendor Information

17566
Expand all

IBM

Notified:  August 13, 1999 Updated:  December 10, 2000

Status

  Vulnerable

Vendor Statement

IBM Corporation

The "hostname" vulnerability in the AIX System Backup & Recovery product was fixed in the sysback.rte 4.2.1.13 release. If the output of "lslpp -l sysback.rte" indicates a previous version, customers should contact the IBM Support Center and obtain the latest version.

IBM and AIX are registered trademarks of International Business Machines Corporation.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.


CVSS Metrics

Group Score Vector
Base N/A N/A
Temporal N/A N/A
Environmental N/A

References

Credit

Our thanks to Kiki Lee for reporting this vulnerability.

This document was written by Shawn V Hernan.

Other Information

CVE IDs: None
Severity Metric: 1.35
Date Public: 2000-12-10
Date First Published: 2000-12-12
Date Last Updated: 2000-12-12 23:11 UTC
Document Revision: 6

Sponsored by the Department of Homeland Security Office of Cybersecurity and Communications.